Due to the accelerated trend in electronic control of a vehicle control device, multiple electronic control devices are mounted on each vehicle in recent years (refer to PTL 1 and the like). Each of these electronic control devices is supplied with driving power from a power supply such as a battery. Also, between the power supply and the electronic control device, a power supply relay is normally inserted as a means for supplying/breaking the driving power. Also, in a target device to be controlled by the electronic control device, a power supply relay or a circuit for supplying/breaking the power is generally inserted.
Each of the electronic control devices needs to perform control to guide a corresponding system to a safe direction in a case in which any abnormality occurs. Generally disclosed is a technique in which the electronic control device detects the abnormality by means of a monitor microcomputer or a main microcomputer of its own and breaks the power supply relay of the target device or the power supply circuit to move to a fail-safe state.
For example, in an electronic control device for an engine, a main microcomputer for throttle control, ignition control, and fuel injection control makes a self-diagnosis in terms of an input function, an operation function, an output function, and a storage function to confirm whether or not the main microcomputer itself is normal. The electronic control device has also implemented therein a monitor device such as a sub-microcomputer to monitor a functional failure of the main microcomputer. In a case in which the sub-microcomputer detects a failure, the sub-microcomputer breaks a power supply relay of an electronic throttle valve that the electronic control device is controlling and physically breaks an output unit of a fuel injection valve.
With such a configuration, even with no guarantee of bringing the target device to the fail-safe state due to the abnormality of the main microcomputer, the target device can reliably be brought to the fail-safe state by the monitor device such as the sub-microcomputer. Such a technique is known.
Also known is a technique in which an electronic control device is provided that collectively controls power supply relays connected to a plurality of electronic control devices respectively fulfilling predetermined functions and connected through a LAN and detects whether or not a communication state is present depending on the state of each of the power supply relays to determine whether or not the power supply relay is failed (refer to PTL 2 and the like).